Grafana: Allow access to /metrics only to monitoring network and localhost

Fixes privatestorageops#408

nixos/modules/monitoring/server/grafana.nix

@@ -183,6 +183,17 @@ in {
           proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
           proxyWebsockets = true;
         };
+        locations."/metrics" = {
+          # Only allow our monitoringvpn subnet
+          # And localhost since we're the monitoring server currently
+          extraConfig = ''
+            allow ${config.grid.monitoringvpnIPv4}/24;
+            allow 127.0.0.1;
+            allow ::1;
+            deny all;
+          '';
+          proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
+        };
       };
     };